CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse
CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse End-to-end encryption for a group call is only as strong as the membershi…
DevOps
⚑ Сообщить о проблемеПоследние новости DevOps от Tech News
Все темы
agents
ai
api
architecture
automation
aws
backend
beginners
cloud
database
devchallenge
devops
docker
javascript
kubernetes
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
Чистим шумный SBOM: как убрать неэксплуатируемые уязвимости в Kubernetes с помощью VEX
В SBOM-отчёте оказались уязвимости компонентов, которых даже нет в вашем софте. Ничего необычного: просто сканер безопасности подтянул все непрямые…
CVE-2026-40281 Explained: A Patch That Guarded "=" on One Side Only
Overview Item Detail CVE ID CVE-2026-40281 Affected product Gotenberg (Docker-powered PDF conversion API, thecodingmachine/gotenberg) Affected versi…
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean Vulnerability overview CVE-2026-96358 appears in CERT-BUND advisory WID-S…
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root The vulnerability in one paragraph MikroTik RouterOS be…
CVE-2026-92957: CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass
CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass Vulnerability ID: CVE-2026-92957 CVSS Score: 9.9 Publ…
CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root
Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel & WHM — EmailTrack (Email ▸ Track Delivery) Vulnerability class CWE-89…
CVE-2026-43783: Починить права — получить root: LPE через DesktopServicesHelper в macOS 26.5
Привет, Хабр! Меня зовут Илья Андр и я работаю в команде PT Maze. В статье расскажу, как любопытство помогло мне найти и помочь закрыть CVE-2026-437…
GitLab ships critical patch across 19.4, 19.3 and 19.2
What shipped GitLab pushed a critical patch release on 23 September covering three active branches at once: 19.4.1, 19.3.3 and 19.2.7. The release n…
CVE-2026-31431 \"Copy Fail\": A Deep Dive into the Linux algif_aead Privilege Escalation
Vulnerability Overview Field Detail CVE ID CVE-2026-31431 Nickname Copy Fail CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected comp…
Automating Threat Intelligence: Integrating CVE Bots and Open Datasets into Your SecDevOps Pipeline
Originally published on tamiz.pro . Introduction: The Shift from Reactive to Proactive Security The traditional security operations model is no long…
CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module
CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module Vulnerability ID: CVE-2026-63349 CVSS Score: 7.0 Publishe…
How Log4Shell Works: Breaking Down CVE-2021-44228
INTRODUCTION Log4jShell is a software vulnerability in Apache Log4j 2 which is a popular java library used for logging events in java-based applicat…
CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch
Overview CVE ID CVE-2026-16723 Affected Fastjson 1.2.68 – 1.2.83 (every 1.x release still receiving use) Preconditions Spring Boot executable fat-JA…
CVE-2026-12243 — How a Percent-Encoded Slash Bypasses NLTK's Path Traversal Guard
CVE ID CVE-2026-12243 Affects NLTK (Natural Language Toolkit) ≤ 3.9.4 Weakness CWE-22 (Path Traversal) CVSS 3.1 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C…
«Кто я?» — исследуем нестареющую классику OS command injection
«Кто я?» — вопрос, над которым люди размышляют веками. Но whoami для админа — обычная команда. А для атакующего, который только что нашел…
A SQL escape is not a shell escape: OS command injection in GOautodial goAPIv2
TL;DR What: In GOautodial's goAPIv2 agent API, the goPhone request parameter is escaped for SQL ( mysqli_real_escape_string ) and then concatenated…
CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files
Originally published at HOL CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files from Checkpoint Indexes TL;DR…
CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation
Originally published at HOL CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation TL;DR: HiveServer2's SAML HTTP path accepted a forged…
Чем опасны старые версии Nexus Repository CE
Хранилище артефактов, как правило, находится в критическом месте инфраструктуры компании: между сборкой продукта и внешним миром. Через него команды…
GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles
GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles Vulnerability ID: GHSA-5CWR-5JXG-PCF6 C…
nginx is not the bug. Two lines of your config are. CVE-2026-42945 on a live stand
A critical nginx vulnerability, 9.2 on CVSS, sat in the code for eighteen years. It was found not by a human but by an AI agent, and six hours were…
A text message that runs a command: OS command injection in Gammu SMSD (GHSA-9vjj-v46c-c5qf)
TL;DR What: Gammu SMSD — the daemon behind a huge number of SMS gateways, alerting rigs and 2FA senders — runs an operator-configured hook every tim…
How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")
Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. W…
Aikido buys Root to patch open source in place, without the upgrade dance
Every open-source CVE backlog has that one line item you keep sliding into next quarter. The library is a couple of majors behind, the upgrade break…
Facts — прохождение простой машины от HackTheBox
Простая машина от Hack The Box, на которой работает Camaleon CMS 2.9.0 под управлением nginx. В системе включена функция самостоятельной регистрации…
MITRE CVE ID Request and Support Follow-Up: No Confirmation Email Received Despite Anti-Filter Measures
Introduction: The CVE Request Process and Its Challenges The Common Vulnerabilities and Exposures (CVE) ID request process serves as a cornerstone f…
CVE Severity: Risk-Based Prioritization
In large networks, security teams receive hundreds of CVE notifications every day. It is resource-intensive to patch all vulnerabilities at once and…
CVE-2026-48710: CVE-2026-48710: Starlette BadHost HTTP Host-Header Path-Poisoning and Authentication Bypass
CVE-2026-48710: Starlette BadHost HTTP Host-Header Path-Poisoning and Authentication Bypass Vulnerability ID: CVE-2026-48710 CVSS Score: 7.0 Publish…
Больше, чем просто безопасность, или Зачем контролировать зависимости
Привет, Хабр! Меня зовут Артём Бердашкевич, в Positive Technologies руковожу направления DevSecOps. Сегодня хочу поговорить о теме, которая с годами…